Setup Guides · Zoho Mail
Zoho Mail SPF Setup: one record, the right include and the 10-Lookup Trap
SPF is the DNS record that tells receiving mail servers which senders are allowed to use your domain. Zoho Mail's SPF setup is genuinely simple - one TXT record - and yet it is one of the most commonly broken records on Zoho-hosted domains, almost always for one of five very repeatable reasons. This guide covers the exact record, the Admin Console verification, and those five failures.
Last updated 30 August 2026 · applies to all Zoho Mail plans with a custom domain
Zoho Mail authentication series: SPF · DKIM · DMARC
The record
For a domain that sends only through Zoho Mail, this is the whole thing:
Host: @ Type: TXT Value: v=spf1 include:zohomail.com -all
Three details people get wrong:
- It is
zohomail.com, notzoho.com. The include target is Zoho's sending infrastructure, not their website. This mistake is common enough that it gets its own entry in the failures below. -allvs~all:-all(hard fail) tells receivers to reject anything not from Zoho;~all(soft fail) says "mark it suspicious". Zoho recommends-allwhen Zoho is your only sender. If other services also send as your domain (a CRM, a helpdesk, a newsletter tool), list them in the same record and consider~allwhile you confirm the list is complete.- One record. Ever. If your DNS already has a TXT starting with
v=spf1, you edit that record - you never add a second one. Two SPF records is a permanent error (permerror) at the receiver, and your mail is judged as if you had no SPF at all.
The setup, step by step
1 Check what you already have
Before touching anything, look up your current SPF with the free SPF checker. If a record exists (old provider, website builder, a previous admin), note every include: in it - you are about to merge, not replace, if any of those senders are still real.
2 Publish the TXT record at your DNS host
At your DNS provider (where your nameservers point - not necessarily where you bought the domain), add or edit the TXT record on the bare domain (host @) with the value above. If other services legitimately send as your domain, they join the same record, for example:
v=spf1 include:zohomail.com include:_spf.yourcrm.com ~all
3 Verify inside Zoho
Sign in to the Zoho Mail Admin Console as Administrator or Super Administrator, open Domains in the left pane and select your domain, then go to Email Configuration → SPF and click Verify SPF Record.
DNS changes usually propagate in minutes but can take longer depending on the old record's TTL. If Verify fails immediately after publishing, wait and retry before changing anything.
4 Prove it end to end
Zoho's Verify button confirms the record exists - it does not prove real mail passes. Send one message to Postbox Mailtester (Free Email Deliverability Audit): it shows SPF pass/fail on an actual delivered email, plus DKIM, DMARC alignment, blacklists and rendering in the same report.
The five failures that actually break Zoho SPF
1. Two SPF records
The classic. An old provider's record was never removed when the domain moved to Zoho, or a website plugin added its own. Receivers hit two v=spf1 TXTs, declare permerror, and treat the domain as having no SPF. Fix: merge every legitimate sender into ONE record, delete the rest.
2. The old provider's include left behind
The single record still says include:_spf.google.com or include:spf.protection.outlook.com from the pre-migration setup. Mail works, so nobody notices - but the record now authorizes infrastructure you no longer control, and anyone who can send from that provider's shared pool as your domain will pass your SPF. Prune includes to services that still send for you.
3. include:zoho.com
Still taught by many third-party guides, and it survives precisely because it is not broken: zoho.com does publish an SPF record, so an include pointing at it resolves normally. The real problems are scope and cost. It is far broader than Zoho Mail - it authorises Zoho's whole sending estate (campaigns, transactional, POP relays), not just the mail service you use - and it is expensive: include:zoho.com nests four further includes, spending about five of your ten DNS lookups where include:zohomail.com spends two. On a page named after the 10-lookup trap, that gap is the argument. Use the narrower include:zohomail.com.
4. The 10-lookup limit
SPF allows at most 10 DNS lookups per check; every include: spends some. Stack Zoho + CRM + helpdesk + marketing + a legacy include and you cross the line - result: permerror, same as having a broken record. If you use several Zoho services (Mail, ZeptoMail, Campaigns), Zoho's consolidation include one.zoho.com covers them all in a single entry - but note the trade: it spends about four of your ten lookups, against two for include:zohomail.com. If Zoho Mail is all you send through, the narrower include leaves far more headroom. For third-party stacks, count your lookups - the SPF checker counts them for you.
5. SPF passes, DMARC still fails
SPF checks the invisible envelope sender; DMARC additionally requires it to align with the From domain your reader sees. Zoho Mail sends your normal mail with an aligned envelope, so this usually just works - until a newsletter or CRM tool sends "as" your domain with its own envelope. Their SPF passes for their domain and does nothing for your DMARC. Check the full picture with a free Spoof Check.
Verify it end to end
- Record check: syntax, the right include and your lookup count with the free SPF checker.
- One-email audit: send a message to Postbox Mailtester - SPF, DKIM, DMARC alignment and the full deliverability picture.
- Spoofability: can strangers still send as your domain? Run a Postbox Spoof Check.
Frequently asked questions
Is it include:zoho.com or include:zohomail.com?
include:zohomail.com. The zoho.com variant circulates widely in third-party guides; it is not broken - zoho.com does publish an SPF record - but it is far broader than Zoho Mail and spends about five DNS lookups against your ten-lookup budget, where include:zohomail.com spends two. Use the narrower one.
Should I use ~all or -all?
Zoho recommends -all when Zoho Mail is your only sender. Use ~all temporarily while you are still confirming every service that legitimately sends as your domain - then tighten.
What is include:one.zoho.com?
Zoho's consolidated include covering Zoho Mail, ZeptoMail and Zoho Campaigns. It spends about four DNS lookups against your ten-lookup budget, where include:zohomail.com spends two - so use it only if you actually run several Zoho services and separate includes are crowding the limit.
I added the record but Zoho's Verify fails
Usually propagation (wait out the old TTL) or the record landed on the wrong host - it belongs on the bare domain (@), not www or a subdomain. Check what resolvers actually see with the SPF checker.
Does SPF alone stop spoofing?
No. SPF without DMARC is a suggestion receivers may ignore, and it never protects the visible From address by itself. Pair it with DKIM and a DMARC policy - run a Spoof Check to see your current exposure.
Primary reference: Zoho Mail Admin Help - SPF Configuration. Also in Setup Guides: Zoho Mail DKIM · Zoho Mail DMARC · Microsoft 365 SPF · Google Workspace SPF.
Stuck, or want the whole domain checked in one pass?